Gumpworks is a hosting and engineering shop for the next layer of the web. We run the infrastructure, the identity layer, and the security posture that let a small team ship something that behaves like a large one.

This is the short version of what we do and how the pieces fit together.

What we mean by Web 4.0

Web 4.0 is not a single protocol. It is the point where three things stop being separate projects:

• **Identity is a first-class service.** Every person, app, and agent has a stable identifier and a scoped credential, not a shared password in a config file.
• **Software is agent-ready.** The same system that serves a browser also serves a machine: documented endpoints, machine-readable skills, predictable errors, and tokens that expire.
• **Trust is verifiable.** Access is granted per app and per user, logged, rate-limited, and revocable. You can answer "who did what, with which key, and when" without guessing.

That is the stack we host. Not a buzzword, a set of properties you can test.

Products

Technology

We run the boring parts so you can run the interesting ones.

• **Managed application hosting.** Node.js services, static sites, content APIs, and background workers behind a reverse proxy, with health checks and restart policies.
• **GAUTH, our authentication service.** Client accounts, apps, app users, scoped tokens, introspection, revocation, and a management API. One identity layer across every product you run with us.
• **Agent skills.** Every service we host ships a machine-readable manual, so an agent can bootstrap against it without a human translating the docs.
• **Content and file infrastructure.** A markdown CMS, a file registry with stable addresses, and a delivery path that does not require a separate CDN contract.
• **APIs that behave.** Versioned endpoints, consistent error shapes, and tokens with explicit lifetimes.

Security

Security is a property of the deployment, not a checkbox on a pricing page.

• **Scoped credentials.** Short-lived tokens, per-app secrets, and keys that can be rotated or revoked without a migration.
• **Rate limiting and lockouts.** Failed sign-ins back off. The wait doubles. You can see the lockout and clear it.
• **Least privilege by default.** An app user is scoped to one app or app family. A client key manages its own apps and nothing else.
• **Isolation.** Services run in containers with non-root users, separate networks, and no shared filesystem beyond what is mounted on purpose.
• **Auditability.** Sign-ins, token issuance, and administrative actions leave a trail you can read.
• **No secret sprawl.** Credentials live in the environment, not in the repository, and the app never stores a user's password.

Services

We work in three modes, depending on how much you want to own.

• **Hosted.** You bring the app. We run the runtime, the proxy, the identity layer, and the backups.
• **Integrated.** We wire GAUTH into an existing product: sign-in, app users, token exchange, and the management surface your team needs.
• **Built with you.** We design and ship the service, then hand over the keys and the documentation. No lock-in by architecture.

Typical engagements start with one of these:

• Put an existing app behind GAUTH and retire the home-grown login table.
• Stand up a content and file service with a stable public address scheme.
• Harden a deployment: rate limits, token lifetimes, secret handling, and an audit pass.
• Give an agent a documented, scoped way to operate your service.

Who this is for

Small teams with a real product and no appetite for running an identity provider. Operators who want the security model written down. Builders who want their service to be usable by both people and agents without maintaining two systems.

Start here

If you already have an app, the fastest path is to register it in GAUTH, create an app user, and exchange credentials for a token. The GAUTH documentation walks through it end to end.

If you are starting from nothing, tell us what you are building. We will tell you which parts you should own and which parts you should let us run.

Welcome to Gumpworks. Cool software for people who ship.